在servlet多部分post期间无法访问Spring Security信息

Question

我无法在servlet多部分发布期间访问Spring Security信息。Spring Security信息在常规get和post方法中可用，但对于多部分post方法不可用。我试图直接通过SecurityContextHolder.getContext().getAuthentication（）和通过一个访问SecurityContextHolder.getContext().getAuthentication（）的注入服务访问此安全信息，但未成功。

//many import statements not displayed 
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.context.support.SpringBeanAutowiringSupport;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;

public class UploadServlet extends HttpServlet {

    public void service(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
        super.service(req, res);
    }

    public void init(ServletConfig config) throws ServletException { 
        super.init(config); 

        SpringBeanAutowiringSupport.processInjectionBasedOnServletContext(this, 
          config.getServletContext()); 
    } 


    //The following is always injected and available
    //however, it only returns valid security information for regular get and post methods,
    //not for multipart post methods
    @Autowired 
    private CustomUserService customUserService; 

    //The following is always injected and available and always returns the expected data
    @Autowired 
    private GuideService guideService; 

    //the following does not work when the client issues a multipart post, it does work for non-multipart
    public boolean getAuthenticated(){
        boolean authorized = false;

        for (GrantedAuthority authority : SecurityContextHolder.getContext().getAuthentication().getAuthorities()) {
            if(authority.getAuthority().equals("ROLE_USER") || authority.getAuthority().equals("ROLE_ADMIN")) {
                authorized = true;
                break;
            }  
        }

        return authorized;
    }


    //The following test get method works fine
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {           
        if(getAuthenticated()){
            PrintWriter out = resp.getWriter();
            out.write("<h1>Guide Info</h1><br/>");
            Guide guide = guideService.findById(2l);
            out.write(guide.getName() + "<br/>");
            out.write(guide.getDescription() + "<br/>");
            out.write("UserName: " + customUserService.getCurrentUser().getUsername() + "<br/>");
        }
        else{
            PrintWriter out = resp.getWriter();
            out.write("<h1>You're not authorized</h1><br/>");
        }
    }


    //This post method  
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        //the following always works, whether the clients posts using multipart or not      
        String guideName = guideService.findById(2l).getName();

        //the following does not work when the client issues a multipart post, it does work for non-multipart
        String userName = customUserService.getCurrentUser().getUsername();

        //the following does not work when the client issues a multipart post, it does work for non-multipart
        if(getAuthenticated()){
            String responseString = RESP_SUCCESS;
            boolean isMultipart = ServletFileUpload.isMultipartContent(req);

            if (isMultipart) {
                ServletFileUpload upload = new ServletFileUpload();

                //commmons fileupload code

            // Not a multi-part MIME request.
            else {
                //...
            }
            //...
        }
        else{
            //...
        }


    }

}

下面是web.xml的相关部分：

<servlet>
    <servlet-name>fgm</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>WEB-INF/spring/webmvc-config.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup> 
</servlet>

<servlet-mapping>
    <servlet-name>fgm</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

<servlet>
    <servlet-name>UploadServlet</servlet-name>
    <servlet-class>com.guides.servlet.UploadServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>UploadServlet</servlet-name>
    <url-pattern>/upload</url-pattern>
</servlet-mapping>

Answer 1

我可以确认Spring3.0.x和SpringSecurity3.0.x一起可以处理多部分文章，也可以处理其他类型的请求。我遇到过类似的行为，在我们的例子中，由于我们在筛选器映射中的错误，安全筛选器没有被应用到请求中。

您是否可以发布web.xml中定义安全过滤器的部分，并将其映射到所需的路径？